Lion Cipher Lab
Reconstruct user activity from the Windows Timeline (ActivitiesCache.db)
- Digital Forensics & IR (DFIR)
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Again and again an investigation turns on a question of sequence: what did this account actually do, in what order, and when? Execution artifacts (Prefetch, Amcache) tell you a binary ran; Jump Lists name a file an app opened; SRUM tots up resource usage. The Windows Timeline is the artifact that was purpose-built to answer the narrative question, because Microsoft built it to SHOW the user their own history. From the Windows 10 April 2018 update onward, Windows recorded a per-user activity feed — apps launched, documents opened, with start times and focus durations — into a SQLite database,…
What you'll learn
- explaining what the Windows 10/11 Timeline is and where it persists: a per-user SQLite database, ActivitiesCache.db, under %LocalAppData%\ConnectedDevicesPlatform\L.<user>\, recording apps launched and documents opened with times and durations
- opening a SQLite forensic artifact READ-ONLY with Python's stdlib sqlite3 (a file: URI with mode=ro) so you never write to the evidence, after copying and hashing it
- reading the Activity and Activity_PackageId tables, and decoding the JSON Payload (displayText / appDisplayName / description) and the ActivityType codes that separate an app-launch from an app-in-focus record
- converting Unix-epoch timestamps to human UTC times and ordering the rows into a defensible 'what did this user do and when' timeline
- resolving AppId -> program by parsing the AppId JSON and joining Activity_PackageId, so you can name the application behind each activity
- stating the honest limits: the Timeline was deprecated and its UI retired in Windows 11 so the artifact varies by build/policy and may be absent or sparse; times are UTC epoch; the Payload schema is undocumented and varies; it is corroborating evidence, not proof, and belongs in a super-timeline cross-checked against Prefetch/SRUM
Steps in this lab
- From zero: what the Windows Timeline is, and where it lives
- Build a synthetic ActivitiesCache.db so the lab runs offline
- Forensic soundness: copy, hash, and open the database READ-ONLY
- Count and classify: how many activities, and of what type
- Decode the Payload JSON and the epoch timestamps into a human timeline
- Resolve AppId -> program by joining Activity_PackageId
- The honest negative: what the Timeline does NOT prove, and its shaky availability
- When / why / better: fit it into a super-timeline and cross-check